docs: Q1c GREEN — reboot survival automatic since agent 0.84.0 (feature doc + audit §7 + CONTEXT + REPORT)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/controller/network-storage-nas.md

@@ -133,17 +133,32 @@ add pipeline. Exact steps for the customer/operator:
 
 **QNAP remains a stated caveat** — no emulator exists; not validated.
 
-## Open items
+## Reboot survival (Q1c) — automatic since agent v0.84.0, live-proven 2026-07-11
 
-- **Q1c CLOSED — FAIL (SPIKE-nas-dsm-2026-07-11 §Q1c, supervised):** a configured NAS automount
-  trigger does **not** survive a guest reboot. `mp8` is `shared`→`shared,slave`; slave propagation
-  only carries mounts established AFTER the guest's post-reboot bind, so the pre-existing host autofs
-  trigger is absent from the guest's fresh namespace, and an in-guest access sees an **empty
-  directory** (not the share) without triggering the host mount. The controller's per-share health
-  still reads `idle`/`ok` (it inspects the HOST automount), masking the gap. **Fix = agent-side
-  `ReassertNetworkMounts` on guest reboot** (mirror `ReassertGuestBinds`), spec'd at
-  `documentation/backlog/FOLLOWUP-nas-automount-guest-reboot-reassert.md`; interim workaround = re-add
-  the share. Until fixed, a customer guest reboot requires re-touching NAS shares.
+The Q1c failure (a fresh guest namespace inherits real mounts but NOT an idle autofs trigger →
+silent local stub after any guest reboot; RCA `documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md`)
+is FIXED by the pair **agent v0.84.0 + controller v0.117.0**:
+
+- **Agent `ReassertNetworkMounts`** (storage `ReassertNetworkAutomounts`): per share — real mount →
+  skip (inherited); idle autofs trigger → `systemctl stop` + `enable --now` the `.automount`
+  (existing sudoers verbs; the fresh trigger-mount event propagates into every running guest's slave
+  bind), then best-effort per-guest `GuestSeesMount` verify. Runs (a) from the **guest-hook
+  post-start phase** (root, direct systemctl, non-fatal by contract) and (b) once at **agent
+  startup** (guests that autostarted before the agent). Never from periodic health paths — an idle
+  trigger is healthy.
+- **Controller consuming-namespace verification** (the detection net beneath it): statfs f_type
+  classifier; `--netprobe` refuses a non-network dir (`not_network_fs`, full rollback); deploys onto
+  a stubbed network `HDD_PATH` are refused (409); a distinct dashboard **stub badge** ("Hálózati
+  tárhely hibás — az alkalmazás nem a NAS-t látja") wins over the recoverable unreachable badge.
+
+**Live proof (2026-07-11 21:20, demo `pct reboot 9201`):** the start-task transcript itself carried
+`felhom-agent guest-hook: vmid 9201 post-start — network share nas-media visible in guest (rearmed)`;
+post-boot with NO manual action the guest had trigger + nfs4, calibre-web auto-started healthy on
+the NAS library, uid-1000 write-through OK, health `status=ok` on the first cycle, no storage badge.
+(The backlog spec `documentation/backlog/FOLLOWUP-nas-automount-guest-reboot-reassert.md` is
+implemented by this.)
+
+## Open items
 - QNAP appliance fidelity pass (no emulator) before GA — Synology is now validated.
 - The demo's `nas-media` share predates `retry=0`; re-adding re-creates the unit with the current
   option string.